[GH-ISSUE #3063] Port 44338/tcp needs to be open in firewalld for SSH access #6315

Open
opened 2026-08-05 01:07:43 -04:00 by saavagebueno · 10 comments
Owner

Originally created by @orchard0 on GitHub (Dec 17, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3063

Describe the problem

Unless port 44338/tcp is opened in firewalld Netbird SSH access won't work. ufw firewall doesn't need any open ports.

To Reproduce

Steps to reproduce the behavior:

  1. Use a Linux OS using firewalld.
  2. sudo netbird ssh server@ubu

Error received:
Error: dial tcp 100.77.74.220:44338: connect: no route to host Couldn't connect. Please check the connection status or if the ssh server is enabled on the other peer

Expected behavior

Netbird SSH access should work without opening any ports in firewalld. This is partly its primary usefulness.

Are you using NetBird Cloud?

Self-host NetBird's control plane.

NetBird version

0.34.1

Additional context

I've tested this on Ubuntu 24.04, Fedora 41 Server and AlmaLinux 9.5.

It should be noted that port 44338/tcp doesn't need to be opened on an external firewall like a router or virtual server's external firewall. It's only need on the Linux OS that's using firewalld.

Turning off firewalld or opening a port using sudo firewall-cmd --add-port=44338/tcp --permanent fixes the issue. Alternatively using ufw also works. However, using ufw is not always an option.

Originally created by @orchard0 on GitHub (Dec 17, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3063 **Describe the problem** Unless port `44338/tcp` is opened in `firewalld` Netbird SSH access won't work. `ufw` firewall doesn't need any open ports. **To Reproduce** Steps to reproduce the behavior: 1. Use a Linux OS using firewalld. 2. `sudo netbird ssh server@ubu` Error received: `Error: dial tcp 100.77.74.220:44338: connect: no route to host Couldn't connect. Please check the connection status or if the ssh server is enabled on the other peer` **Expected behavior** Netbird SSH access should work without opening any ports in firewalld. This is partly its primary usefulness. **Are you using NetBird Cloud?** Self-host NetBird's control plane. **NetBird version** `0.34.1` **Additional context** I've tested this on Ubuntu 24.04, Fedora 41 Server and AlmaLinux 9.5. It should be noted that port `44338/tcp` doesn't need to be opened on an external firewall like a router or virtual server's external firewall. It's only need on the Linux OS that's using `firewalld`. Turning off `firewalld` or opening a port using `sudo firewall-cmd --add-port=44338/tcp --permanent` fixes the issue. Alternatively using `ufw` also works. However, using `ufw` is not always an option.
saavagebueno added the questionssh labels 2026-08-05 01:07:43 -04:00
Author
Owner

@lixmal commented on GitHub (Dec 24, 2024):

Hi @orchard0, can you test with 0.35.0 without the extra rule please?

<!-- gh-comment-id:2560966935 --> @lixmal commented on GitHub (Dec 24, 2024): Hi @orchard0, can you test with 0.35.0 without the extra rule please?
Author
Owner

@orchard0 commented on GitHub (Dec 24, 2024):

Hi @lixmal I've tested this with 0.35.0 on peer and host and the firewalld rule is still required.

<!-- gh-comment-id:2561066070 --> @orchard0 commented on GitHub (Dec 24, 2024): Hi @lixmal I've tested this with 0.35.0 on peer and host and the firewalld rule is still required.
Author
Owner

@B08Z commented on GitHub (Mar 27, 2025):

I have also tested on 39.1 and its still the same. Is there a way around that?

<!-- gh-comment-id:2757706030 --> @B08Z commented on GitHub (Mar 27, 2025): I have also tested on 39.1 and its still the same. Is there a way around that?
Author
Owner

@nazarewk commented on GitHub (Mar 27, 2025):

I am pretty sure this is working as intended. The system's firewall is expected to block everything not explicitly allowed.

If you want it to work as a routing peer, you also need to configure your firewall to allow forwarding from wt0 interface to the routed subnet's interface, unless you don't have one at all.

<!-- gh-comment-id:2758531834 --> @nazarewk commented on GitHub (Mar 27, 2025): I am pretty sure this is working as intended. The system's firewall is expected to block everything not explicitly allowed. If you want it to work as a routing peer, you also need to configure your firewall to allow forwarding from `wt0` interface to the routed subnet's interface, unless you don't have one at all.
Author
Owner

@orchard0 commented on GitHub (Mar 31, 2025):

The feature is "Enhancing Security: Creating a secure overlay network that implements zero-trust principles, eliminating the need for exposed inbound ports." from the docs

Unless I've not understood that correctly this is not working as intended.

<!-- gh-comment-id:2765432225 --> @orchard0 commented on GitHub (Mar 31, 2025): The feature is "Enhancing Security: Creating a secure overlay network that implements zero-trust principles, **eliminating the need for exposed inbound ports."** from the [docs](https://docs.netbird.io/how-to/secure-remote-webserver-access) Unless I've not understood that correctly this is not working as intended.
Author
Owner

@nazarewk commented on GitHub (Mar 31, 2025):

Unless I've not understood that correctly this is not working as intended.

There is some merit to it and I am pretty sure it is technically possible (at least of nftables), but we would need to discuss whether punching holes through a tightly locked-down device is an intended use to begin with.

Personally I don't think I would be OK with a "random app from the internet" opening something up by mere virtue of starting up in my highly secure router without getting my approval (through opening up what I think is OK myself).

<!-- gh-comment-id:2766584970 --> @nazarewk commented on GitHub (Mar 31, 2025): > Unless I've not understood that correctly this is not working as intended. There is some merit to it and I am pretty sure it is technically possible (at least of `nftables`), but we would need to discuss whether punching holes through a tightly locked-down device is an intended use to begin with. Personally I don't think I would be OK with a "random app from the internet" opening something up by mere virtue of starting up in my highly secure router without getting my approval (through opening up what I think is OK myself).
Author
Owner

@B08Z commented on GitHub (Apr 2, 2025):

Unless I've not understood that correctly this is not working as intended.

There is some merit to it and I am pretty sure it is technically possible (at least of nftables), but we would need to discuss whether punching holes through a tightly locked-down device is an intended use to begin with.

Personally I don't think I would be OK with a "random app from the internet" opening something up by mere virtue of starting up in my highly secure router without getting my approval (through opening up what I think is OK myself).

But isn't that why --allow-server-ssh is used.
I think it should be possible to have ssh working without opening any firewall ports.

<!-- gh-comment-id:2772380582 --> @B08Z commented on GitHub (Apr 2, 2025): > > Unless I've not understood that correctly this is not working as intended. > > There is some merit to it and I am pretty sure it is technically possible (at least of `nftables`), but we would need to discuss whether punching holes through a tightly locked-down device is an intended use to begin with. > > Personally I don't think I would be OK with a "random app from the internet" opening something up by mere virtue of starting up in my highly secure router without getting my approval (through opening up what I think is OK myself). But isn't that why --allow-server-ssh is used. I think it should be possible to have ssh working without opening any firewall ports.
Author
Owner

@nazarewk commented on GitHub (Apr 2, 2025):

FYI: I just synced with the developer, and it looks like this issue (and the full description confirms it) is implementation-specific to firewalld.

Out of the box, netbird is already opening up the firewall successfully for all other (so far known) scenarios, but firewalld is setting up more complex rules that Netbird's implementation is not handling well and would need to implement as a separate edge-case.

<!-- gh-comment-id:2772952620 --> @nazarewk commented on GitHub (Apr 2, 2025): FYI: I just synced with the developer, and it looks like this issue (and the full description confirms it) is implementation-specific to `firewalld`. Out of the box, `netbird` is already opening up the firewall successfully for all other (so far known) scenarios, but `firewalld` is setting up more complex rules that Netbird's implementation is not handling well and would need to implement as a separate edge-case.
Author
Owner

@p-arndt commented on GitHub (Jun 12, 2025):

Just setup Netbird, wanted to use the SSH Feature and found this issue.
I am using ufw on my ubuntu server and also had to open port 44338 in order to connect to it.

BUT when using windows terminal i cant get it running. Always getting the same error like:

Error: failed to run raw terminal: The parameter is incorrect.

Any advice on this (except "Do not use Windows" :D )

<!-- gh-comment-id:2968036703 --> @p-arndt commented on GitHub (Jun 12, 2025): Just setup Netbird, wanted to use the SSH Feature and found this issue. I am using `ufw` on my ubuntu server and also had to open port 44338 in order to connect to it. BUT when using windows terminal i cant get it running. Always getting the same error like: ``` Error: failed to run raw terminal: The parameter is incorrect. ``` Any advice on this (except "Do not use Windows" :D )
Author
Owner

@Exitium-DEV commented on GitHub (Oct 20, 2025):

Just setup Netbird, wanted to use the SSH Feature and found this issue. I am using ufw on my ubuntu server and also had to open port 44338 in order to connect to it.

BUT when using windows terminal i cant get it running. Always getting the same error like:

Error: failed to run raw terminal: The parameter is incorrect.

Any advice on this (except "Do not use Windows" :D )

Still an issue months later

<!-- gh-comment-id:3422528358 --> @Exitium-DEV commented on GitHub (Oct 20, 2025): > Just setup Netbird, wanted to use the SSH Feature and found this issue. I am using `ufw` on my ubuntu server and also had to open port 44338 in order to connect to it. > > BUT when using windows terminal i cant get it running. Always getting the same error like: > > ``` > Error: failed to run raw terminal: The parameter is incorrect. > ``` > > Any advice on this (except "Do not use Windows" :D ) Still an issue months later
Sign in to join this conversation.
No Label question ssh
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#6315